Sucuri Security – Auditing, Malware Scanner and Security Hardening

Description

Sucuri Inc. is a globally recognized authority in all matters related to website security, with specialization in WordPress Security.

The Sucuri Security WordPress plugin is free to all WordPress users. It is a security suite meant to complement your existing security posture. It offers its users a set of security features for their website, each designed to have a positive affect on their security posture:

Post Hack Tools - Offers multiple tools to react after the suspiciousness of a hack.

Settings - Offers multiple settings to configure the functionality of the plugin.

Installation

The installation of the Sucuri Security WordPress Security plugin is very simple and straight forward. A detailed breakdown of the process is available here (including images), however, below we outline the bare minimum steps.

To install Sucuri Security and complement your Security posture:

Log into your WordPress administration panel,

In the sidebar, choose “Plugins” and then “Add New”,

Type “sucuri” or “sucuri-scanner” in the search box,

Install the option with the “By Sucuri Inc.” at the foot,

Once activated, you will find a new icon in the sidebar with the Sucuri logo, go to the plugin’s dashboard and click the button that says “Generate API Key” to activate the event monitoring, this will generate an unique key to authenticate your website against the remote Sucuri WordPress API service,

Feel free to visit the plugin’ settings page to configure other options including the security alerts, hardening options, file system scanner paths, API service communication, among other things.

Visit the Support Forum to ask questions, suggest new features, or report bugs. And recommend the plugin to your friends and colleagues if you think it can help other people.

FAQ

More information can be found on the the Sucuri Security WordPress Security plugin via our free Knowledge Base.

Installation Instructions

The installation of the Sucuri Security WordPress Security plugin is very simple and straight forward. A detailed breakdown of the process is available here (including images), however, below we outline the bare minimum steps.

To install Sucuri Security and complement your Security posture:

Log into your WordPress administration panel,

In the sidebar, choose “Plugins” and then “Add New”,

Type “sucuri” or “sucuri-scanner” in the search box,

Install the option with the “By Sucuri Inc.” at the foot,

Once activated, you will find a new icon in the sidebar with the Sucuri logo, go to the plugin’s dashboard and click the button that says “Generate API Key” to activate the event monitoring, this will generate an unique key to authenticate your website against the remote Sucuri WordPress API service,

Feel free to visit the plugin’ settings page to configure other options including the security alerts, hardening options, file system scanner paths, API service communication, among other things.

Visit the Support Forum to ask questions, suggest new features, or report bugs. And recommend the plugin to your friends and colleagues if you think it can help other people.

What is the security activity auditing?

This is perhaps the most underutilized security function. It’s the act of monitoring all security related events within your WordPress install. The challenge is, what makes up a security event. In the eyes of Sucuri, any change that occurs within the application could be categorized as a security event, as such we try to record it.

This is important because it gives you, the website owner, the ability to keep a good eye on the various changes occurring within your environment. Who is logging in? What changes are being made?

This feature is logging all activity to the Sucuri cloud, for safe keeping. This ensures that an attacker is not able to wipe your forensic data and prevent further security analysis after a compromise. If an attacker is able to bypass your security controls, your security logs will be kept safe within the Sucuri Security Operations Center (SOC).

This feature is particularly important to website / system administrators and security experts looking to understand what is going on with their website and when it’s happening.

What is the file integrity monitoring

Security File Integrity Monitoring has been fundamental to the world of security. It’s the act of comparing a known good with the current state. If the current state differs from the known good, you know you have a problem. This is the basis of a lot of host intrusion detection systems. It’s what we have built into the plugin.

It will create a known good the minute the plugin is installed. This will be of all the directories at the root of the install, this includes plugins, themes and core files.

What is the remote malware scanning?

This feature is powered by our scanning engine, found on our free security scanner – SiteCheck. It’s important to take some time to understand how this scanner works. There are limitations with the way this scanner works, you can find more information in the FAQ section.

What is the blacklist monitoring?

Another very interesting feature of the Security Malware Scanner is that it incorporates various blacklist engines. Security blacklist engines include the following:

Sucuri Labs

Google Safe Browsing

Norton

AVG

Phish Tank

ESET

McAfee Site Advisor

Yandex

SpamHaus

Bitdefender

These are some of the largest blacklisting entities, each having the ability to directly impact your brands online reputation. By synchronize with their environments we’re able to tell you, upon scan, whether any of them are negatively flagging your website with a security related issue. If they do, then via our website security product, we’re able to help you get off the their security blacklist.

What is the effective security hardening

It’s easy to get lost in the world of security hardening. At Sucuri we clean hundreds of websites a day, many with the various security hardening configurations you find in various WordPress Security presentations. In this section, we add those that we feel to be most effective, and that complement the entire Sucuri suite of products.

What are the post-hack security actions

Regardless of how good your security posture is, sometimes it’s impossible to prevent the inevitable. When this happens, we’ve included a section to help you walk through the three key things you should do after a compromise.

What are the security notifications

Having all these security features would be useless unless you were notified of the issues. This is why we have made available security alerts. We have also expanded the various security related events, to provide website owners more flexibility in regards to what they want to know about. As a website owner, you have the option to make these security alerts as quiet or noisy as you would like.

What is the website firewall (premium)

This is by far the coolest security feature Sucuri has to offer everyday website owners. It’s an enterprise grade Website Firewall designed to give you the best security protection any website can hope for. It protects your website from a variety of website attacks and security events to include:

Denial of Service (DOS / DDOS) Attacks

Exploitation of Software Vulnerabilities

Zero Day Disclosure Patches

Brute Force Attacks against your Access Control Mechanisms

This is coupled with a number of features like:

Performance Optimization

Advanced Access Control Features

Failover and Redundancy

This is not included as a free option to the plugin, but is integrated so that if purchased you are able to activate. If you prefer to leverage the Sucuri Firewall product by itself, you have the option to operate the Website Firewall WordPress Security plugin in standalone mode.

The Sucuri Security WordPress Security plugin is built by the team that is known for their proactive approach to security. It is built using intelligence gathered from thousands upon thousands of remediation cases, millions of unique domain scans and 10’s of millions of website security attack blocks.

What does this plugin do that other security plugins don’t do?

A few other security plugins provide activity monitoring features, but few do them well. The activity monitoring in this plugin is second to none, tying the activity into the Sucuri Security Operations Center (SOC) ensuring it’s safe keeping.

This security plugin also takes a different approach to security plugins, stripping it of what we categorize as unnecessary features for a basic website end-user. We’ve narrowed the key features we felt were most pertinent to any website owner and integrated them into this plugin.

If I install the Sucuri Security plugin do I get a Sucuri account?

No, this is a free plugin that we offer at no charge. It does not mean you get a free account.

If I have the premium plugin, do I need the Free plugin?

The premium plugin was deprecated back in 2014. All the major features were merged into the free plugin. If you are still using the (old) premium plugin please consider to delete it and install the (new) free plugin from the WordPress plugin market. Notice that you will need to generate a new API key as the new API service does not supports the old one.

Do I still need Sucuri’s products if I have this plugin?

Yes. This plugin compliments your existing security toolsets. It is not designed to replace the Sucuri Website Security or Firewall products.

Where do I get support for this plugin?

The best place is to engage us via the Support Forum. If you are a client, you can submit a ticket here.

Does your plugin conflict with WordFence?

The plugin does not, but there might be issues with our scanners. If you get an “Unable to Properly Scan Your Site” It’s likely because the WordFence plugin is blocking our scanner as an invalid crawler. You would have to white list our IP address on the WordFence dashboard.

What are the Remote Malware Scanner limitations?

Because the security malware scanner is remote, it is unable to see things that are on the server but that are not displaying on the browser. If you are interested in this, we encourage you to subscribe to our website security product. This issues includes things like Phishing pages, Backdoors, Mailer Scripts, etc.

Your plugin didn’t detect this malware?

This happens, reference the remote scanner limitations above. This should not be confused with our website security product. If you have malware, and you are a client, submit a ticket so that we can help you get clean.

If you are not a client, and you want to share what you have found please send it to labs@sucuri.net.

The plugin is not performing application level malware / security scanning so this is not uncommon.

We improve the performance of the code with every release. However, due to differences between hosting providers there are cases where the plugin may affect the responsiveness of the website upon installation. Things like HTTP requests, SSL certificate verifications and DNS lookups are among the few things that, depending on how your web server is configured, will slow down your website.

Do the logs get stored to my database?

No, it does not.

Are there any issues installing your plugin with any hosts?

Not that we are aware of.

Do I need this plugin to use the Website Firewall service?

No, it is not required. The Website Firewall runs in the cloud without the need of anything installed. This plugin only helps see and manage the service from the WordPress dashboard.

Reviews

I first used this plugin when it became apparent that a WordPress site I themed, had been hacked – basically: one of the user passwords had been compromised and the site was now serving as a spoof/phishing site, mimicking an international banking concern.

With this plugin, I could identify files that have been modified (and remove them), all while locking down all routes of entry and then resetting users.

At the time, this was the only plugin I could find and install in a hurry that was completely free and got me all the way to the safe zone – the post-hack features are second to none.

Everything is fine until you figure out that the plugin is running amok. It is as bad as ransomware because if you do have an issue with the firewall blocking something it shouldn’t be, the only choice you have is to pay for a subscription. Guess what? you can’t even submit a support ticket without paying them. Even if you deactivate the plugin, it still continues to cause problems. Terrible, terrible, terrible.

Doesn’t do anything or help at all. It tells you that there is a blacklisted java script item but not where or what it is and just keeps trying to get you to pay their stupid fees to have one of their idiots fix it… yeah I’ll go elsewhere it wouldn’t surprise me if they are the ones that infected my site because they obviously did not protect it at all…Below edited after conversating with Author who responded to my comment
(Plugin doesn’t do anything to actually earn me “investing” money into it!)

And the Creators Author gets a major attitude about bad reviews… maybe learn how to improve your product rather than trying to belittle people who don’t like your product… tisk tisk

As the ignorant Author continues to make himself look like an idiot by replying more I shall be adding to this review as now he has called me an Idiot vs implying it and continues to throw a tiff and borderline attempt to troll me (of which he is not good at) I shall be using other plugins and spending money for the websites I build and manage elsewhere with a more professional Author and Company…

Easiest way to manage my staff and their appointments. My staff members can have their own Google Calendars. I would like to see an option to let my clients to reschedule their appointments, this would make the plugin perfect on its type.
When I pay I like to get instant support. I opened a ticket and I got a reply within 8 hours, which is a decent reply time. I’m special and I would like to get replied within an hour or two as max because my client can’t wait. Either way, the support was great. It’s understandable over the weekends having this kind of delays.
For my business it works as expected.

A few hours looking on this plugin and API is setup but how to scan? It seems when the plugin was first installed it did a auto scan however the results are from combined cached JS files. how to rescan with cache turned off, been trying to get this to refresh the results but even though the cache plugin is disabled completely your plugin still says I have malware in a cached JS file. All Cache is removed and confirmed by view source code and gtmetrix.